[{"content":"On 21 October 2026 GitLab released a critical patch release that includes CVE-2026-110264, scored CVSS 10.0, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an unauthenticated user run arbitrary code on the GitLab server. The Hacker News has covered it too.\nIf you run a self-managed GitLab, update first and read the rest later.\nSummary ID CVE-2026-110264 Score 10.0 (Critical) Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weakness Integer overflow in the regular expression compiler Reporter joaxcar, via GitLab\u0026rsquo;s HackerOne bug bounty The vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability.\nWhat is going on? Per GitLab, the flaw is an integer overflow while compiling a specially crafted regular expression. According to The Hacker News, this happens in Onigmo, Ruby\u0026rsquo;s built-in regex engine, which GitLab ships and patches.\nThe worrying part: GitLab has not disclosed the exact conditions for exploitation, so for now no configuration setting lets you rule yourself out. Per the report there is no sign of active exploitation and, as of 22 October, it is not in CISA\u0026rsquo;s KEV catalog. That can change quickly.\nWhat is affected? Vulnerable: all versions from 7.0 up to these fixed releases:\nBranch Vulnerable before Fixed in 19.5 19.5.1 19.5.1 19.4 19.4.3 19.4.3 19.3 19.3.6 19.3.6 19.2 19.2.9 19.2.9 19.1 19.1.9 19.1.9 19.0 19.0.10 19.0.10 7.0 to 18.11 18.11.13 18.11.13 GitLab.com is already patched, so only self-managed installs need action. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later are fixed too.\nIf you updated after 12 October to fix CVE-2026-97229 (also CVSS 10), The Hacker News reports those versions (19.2.8, 19.3.5 and 19.4.2) do not include this new fix, so you need to update again.\nWhat to do Update to the fixed release for your branch. GitLab offers no interim workaround; upgrading is the only certain protection.\nMind the migrations. 19.4.3 and 19.3.6 include database migrations. On a single-node instance the upgrade causes downtime, because migrations must finish before GitLab can start. Multi-node setups can use the zero-downtime procedure.\nRestrict access until you update. If your instance is internet-facing and you cannot upgrade right away, temporarily limit access with a firewall, VPN or allowlist. This is not official GitLab guidance, just a general precaution.\nLook for signs of compromise. GitLab published two detections for self-managed instances: \u0026ldquo;Onigmo native worker crash\u0026rdquo; and \u0026ldquo;Org mode render error burst\u0026rdquo;. Run them against your application logs (guide: Detecting security incidents). If the instance has been exposed, also check for unknown files, tokens and runners.\nRotate secrets if in doubt. GitLab usually has access to source code, secrets and CI, so if you suspect a breach, rotate tokens, CI variables and deploy keys.\nReferences GitLab Critical Patch Release: 19.5.1 and other versions The Hacker News report GitLab: Detecting security incidents ","permalink":"https://hosseinagharezaei.ir/posts/gitlab-critical-rce-cve-2026-110264/","summary":"\u003cp\u003eOn 21 October 2026 GitLab released a critical patch release that includes \u003ca href=\"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/\"\u003eCVE-2026-110264\u003c/a\u003e, scored \u003cstrong\u003eCVSS 10.0\u003c/strong\u003e, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an \u003cstrong\u003eunauthenticated\u003c/strong\u003e user run arbitrary code on the GitLab server. \u003ca href=\"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html\"\u003eThe Hacker News\u003c/a\u003e has covered it too.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eIf you run a self-managed GitLab, update first and read the rest later.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2 id=\"summary\"\u003eSummary\u003c/h2\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003e\u003c/th\u003e\n          \u003cth\u003e\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eID\u003c/td\u003e\n          \u003ctd\u003eCVE-2026-110264\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eScore\u003c/td\u003e\n          \u003ctd\u003e10.0 (Critical)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eVector\u003c/td\u003e\n          \u003ctd\u003e\u003ccode\u003eCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\u003c/code\u003e\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eWeakness\u003c/td\u003e\n          \u003ctd\u003eInteger overflow in the regular expression compiler\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eReporter\u003c/td\u003e\n          \u003ctd\u003ejoaxcar, via GitLab\u0026rsquo;s HackerOne bug bounty\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eThe vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability.\u003c/p\u003e","title":"Critical GitLab Flaw (CVSS 10): Unauthenticated RCE, CVE-2026-110264"},{"content":"On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases.\nIf you run PHP, update first and read the rest later.\nSummary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction.\nWhat is going on? CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors. If an allocation fails while request data is only partly initialized, request cleanup may treat the invalid data as valid. That leads to memory corruption and, under certain conditions, RCE. Known triggers involve multipart parsing: a request with no usable content length, an unrestricted number of headers per part, empty file controls that don\u0026rsquo;t count toward max_file_uploads, and nested field names.\nCVE-2026-109619: In long-lived workers, global state (error, session, object and extension state) can keep pointing at request memory after it has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it, causing a use-after-free. Confirmed exploitation paths include PHP 8.5 with fatal_error_backtraces enabled and the session upload progress lifecycle.\nWhat is affected? Vulnerable versions:\nPHP 8.2 before 8.2.35 PHP 8.3 before 8.3.36 PHP 8.4 before 8.4.27 PHP 8.5 before 8.5.12 Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.\nThe NCSC stresses that any organisation using PHP is affected, including products and appliances that bundle it. Unsupported versions older than 8.2 should be moved to a supported release too.\nBy deployment model (per the PHP team\u0026rsquo;s advisories):\nApache mod_php: exploitation validated over HTTP with default settings and normal prefork configurations. PHP-FPM: susceptible according to source analysis, though no complete exploit has been demonstrated. FrankenPHP and LSAPI: likely susceptible, not yet validated. What to do Update. Upgrading to a fixed release is the only complete mitigation.\nFind every PHP install. Start with internet-facing systems, and don\u0026rsquo;t limit the search to old versions. Check containers, Docker images and bundled products (panels, CMSs, appliances). NCSC-NL published an inventory of software with a PHP dependency: NCSC-NL/php2shell.\nIf you can\u0026rsquo;t update right away, apply these partial mitigations:\nSet memory_limit=-1 administratively and restart all workers. Don\u0026rsquo;t use RLIMIT_AS or RLIMIT_DATA: they make mmap() fail and trigger the vulnerable path. Keep post_max_size conservative and enforce request body size at the frontend (Nginx / load balancer). Lower max_input_nesting_level and bound input variables, multipart parts, headers per part and uploads. If your app doesn\u0026rsquo;t use multipart/form-data, block such requests at the frontend. Set session.upload_progress.enabled=0, and on PHP 8.5 set fatal_error_backtraces=0. Then restart workers. If performance doesn\u0026rsquo;t matter, pm.max_requests=1 in PHP-FPM removes state shared between requests. If neither updating nor mitigating is possible, the NCSC suggests taking the system offline.\nCheck for compromise. If the system has been exposed, look for backdoors and unknown files or processes.\nReferences NCSC alert GHSA-w8hw-w9fx-j79w (CVE-2026-109618) GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) NCSC-NL/php2shell ","permalink":"https://hosseinagharezaei.ir/posts/php-critical-rce-cve-2026-109618/","summary":"\u003cp\u003eOn 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled \u003ca href=\"https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php\"\u003e“Critical security issue affecting PHP”\u003c/a\u003e. Two vulnerabilities in PHP itself may let an \u003cstrong\u003eunauthenticated\u003c/strong\u003e attacker achieve \u003cstrong\u003eremote code execution (RCE)\u003c/strong\u003e on a web server running PHP. Both are fixed in new releases.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eIf you run PHP, update first and read the rest later.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2 id=\"summary\"\u003eSummary\u003c/h2\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003e\u003c/th\u003e\n          \u003cth\u003eCVE-2026-109618\u003c/th\u003e\n          \u003cth\u003eCVE-2026-109619\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eTitle\u003c/td\u003e\n          \u003ctd\u003eRCE via OOM corruption\u003c/td\u003e\n          \u003ctd\u003eRCE via stale global state\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eCVSS v4.0\u003c/td\u003e\n          \u003ctd\u003e9.2 (Critical)\u003c/td\u003e\n          \u003ctd\u003e9.2 (Critical)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eVector\u003c/td\u003e\n          \u003ctd\u003e\u003ccode\u003eAV:N/AC:H/AT:P/PR:N/UI:N\u003c/code\u003e\u003c/td\u003e\n          \u003ctd\u003e\u003ccode\u003eAV:N/AC:H/AT:P/PR:N/UI:N\u003c/code\u003e\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eWeakness\u003c/td\u003e\n          \u003ctd\u003euse-after-free, improper error handling\u003c/td\u003e\n          \u003ctd\u003euse-after-free, stale global state\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eBoth are reachable over the network with no login and no user interaction.\u003c/p\u003e","title":"Critical PHP RCE Vulnerability: CVE-2026-109618"},{"content":"In the previous post we built a simple publisher and worker on JetStream. But that worker assumed processing always succeeds. In real systems some messages fail every single time, and if you do nothing they either retry forever or get lost.\nThis post adds three things:\nLimiting attempts with MaxDeliver Spacing out attempts with BackOff and NakWithDelay Routing \u0026ldquo;poison\u0026rdquo; messages to a dead-letter stream I tested every behavior below against an embedded NATS server (with JetStream) and the nats.go client, and the outputs come from that run.\nCreating the consumer explicitly Instead of letting PullSubscribe create a default consumer, we create it with the settings we want:\n_, err = js.AddConsumer(\u0026#34;EVENTS\u0026#34;, \u0026amp;nats.ConsumerConfig{ Durable: \u0026#34;worker-consumer\u0026#34;, AckPolicy: nats.AckExplicitPolicy, AckWait: 30 * time.Second, MaxDeliver: 3, BackOff: []time.Duration{500 * time.Millisecond, time.Second}, FilterSubject: \u0026#34;events.created\u0026#34;, }) MaxDeliver: 3 means each message is delivered at most 3 times. AckWait is how long the server waits for an ack before redelivering. BackOff sets the delays between redeliveries. The worker then binds to that same consumer as before:\nsub, _ := js.PullSubscribe(\u0026#34;events.created\u0026#34;, \u0026#34;worker-consumer\u0026#34;) What does Nak do? When processing fails you can either not ack and wait for AckWait, or explicitly ask for redelivery with Nak. I tried both against a \u0026ldquo;poison\u0026rdquo; message that always fails:\nApproach Observed behavior m.Nak() Redelivered immediately. BackOff has no effect. All 3 attempts happened at second zero. m.NakWithDelay(1 * time.Second) Redelivered after the given delay (attempts 2 and 3 at roughly 1s and 2.5s). Not acking Redelivered following BackOff (attempts 2 and 3 at 0.5s and 1.5s in my run; I used a 2s AckWait for the experiment). Practical takeaway: a plain Nak() is dangerous for transient failures because it spins the worker in a tight retry loop. For errors that probably clear up with a little patience (say, the database is briefly unavailable) use NakWithDelay.\nA more complete worker loop:\nfor _, m := range msgs { if err := process(m.Data); err != nil { log.Println(\u0026#34;process failed:\u0026#34;, err) m.NakWithDelay(time.Second) continue } m.Ack() } When attempts run out: the advisory Once MaxDeliver is reached, JetStream stops delivering the message to this consumer. The message stays in the stream, but JetStream publishes an advisory on this subject:\n$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.\u0026lt;stream\u0026gt;.\u0026lt;consumer\u0026gt; The JSON payload contains the message\u0026rsquo;s sequence number in the stream (stream_seq) and the number of deliveries (deliveries). With that sequence we can fetch the original message.\nBuilding the dead-letter stream We create a separate stream for failed messages and a small service that listens for the advisory:\njs.AddStream(\u0026amp;nats.StreamConfig{ Name: \u0026#34;DLQ\u0026#34;, Subjects: []string{\u0026#34;dlq.events\u0026#34;}, }) nc.Subscribe(\u0026#34;$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.EVENTS.worker-consumer\u0026#34;, func(m *nats.Msg) { var adv struct { Stream string `json:\u0026#34;stream\u0026#34;` StreamSeq uint64 `json:\u0026#34;stream_seq\u0026#34;` Deliveries int `json:\u0026#34;deliveries\u0026#34;` } json.Unmarshal(m.Data, \u0026amp;adv) raw, err := js.GetMsg(adv.Stream, adv.StreamSeq) if err != nil { log.Println(\u0026#34;getmsg:\u0026#34;, err) return } // MsgId prevents storing the same message twice js.Publish(\u0026#34;dlq.events\u0026#34;, raw.Data, nats.MsgId(fmt.Sprintf(\u0026#34;dlq-%d\u0026#34;, adv.StreamSeq))) }) In my test I published three messages: good-1, poison and good-2. The two good ones were delivered once and acked. poison was delivered three times, and then exactly one message landed in the DLQ stream. At the end the consumer had no pending or ack-pending messages.\nA few caveats Advisories are core NATS messages, not JetStream ones. If the DLQ service is down at the moment the advisory is published, it misses it. For critical systems you need a fallback, such as periodically inspecting the consumer with ConsumerInfo or persisting advisories into a stream. The original message is not removed from the stream after hitting MaxDeliver. How long it stays depends on that stream\u0026rsquo;s retention policy. Permanent failures (like a corrupt payload) are pointless to retry. If you can detect them, call m.Term() right away so JetStream never delivers the message again. The MsgId above only deduplicates within the stream\u0026rsquo;s duplicate-detection window. What\u0026rsquo;s next Two topics remain for the next post: running multiple workers on one consumer, and monitoring processing lag. The full code for the base example is in go-nats-demo.\n","permalink":"https://hosseinagharezaei.ir/posts/nats-jetstream-retry-dlq/","summary":"\u003cp\u003eIn the \u003ca href=\"/posts/nats-jetstream-go/\"\u003eprevious post\u003c/a\u003e we built a simple publisher and worker on JetStream. But that worker assumed processing always succeeds. In real systems some messages fail every single time, and if you do nothing they either retry forever or get lost.\u003c/p\u003e\n\u003cp\u003eThis post adds three things:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eLimiting attempts with \u003ccode\u003eMaxDeliver\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eSpacing out attempts with \u003ccode\u003eBackOff\u003c/code\u003e and \u003ccode\u003eNakWithDelay\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eRouting \u0026ldquo;poison\u0026rdquo; messages to a \u003cstrong\u003edead-letter\u003c/strong\u003e stream\u003c/li\u003e\n\u003c/ol\u003e\n\u003cblockquote\u003e\n\u003cp\u003eI tested every behavior below against an embedded NATS server (with JetStream) and the \u003ccode\u003enats.go\u003c/code\u003e client, and the outputs come from that run.\u003c/p\u003e","title":"Retry and Dead-Letter Queues in NATS JetStream with Go"},{"content":"When I want to really understand a concept, I build the smallest runnable example of it. This time it was NATS JetStream. The result is go-nats-demo: a publisher, a worker and NATS itself, all wired together with Docker Compose.\nWhy JetStream? Core NATS only delivers messages to subscribers that are connected at that moment. If the worker is down, the message is gone. JetStream adds persistence on top of NATS: messages are stored in a stream, and consumers can read them later and acknowledge them.\nLayout go-nats-demo/ ├── docker-compose.yml ├── publisher/ (Dockerfile + main.go) └── worker/ (Dockerfile + main.go) NATS with JetStream and the monitoring dashboard on port 8222 Publisher sends a message to events.created every 2 seconds Worker reads messages, logs them and acks Connecting with retry Docker Compose doesn\u0026rsquo;t guarantee NATS is up before our services. So both services try to connect up to 10 times, 2 seconds apart:\nfunc connectNATS(url string) *nats.Conn { for i := 0; i \u0026lt; 10; i++ { nc, err := nats.Connect(url) if err == nil { return nc } log.Println(\u0026#34;Waiting for NATS to be ready...\u0026#34;, err) time.Sleep(2 * time.Second) } log.Fatal(\u0026#34;Failed to connect to NATS after 10 attempts\u0026#34;) return nil } Publisher: create the stream and publish The publisher creates the stream if it doesn\u0026rsquo;t exist, then publishes in a loop:\njs, _ := nc.JetStream() _, err := js.AddStream(\u0026amp;nats.StreamConfig{ Name: \u0026#34;EVENTS\u0026#34;, Subjects: []string{\u0026#34;events.created\u0026#34;}, }) if err != nil \u0026amp;\u0026amp; err != nats.ErrStreamNameAlreadyInUse { log.Fatal(err) } for { msg := []byte(time.Now().Format(time.RFC3339)) if _, err := js.Publish(\u0026#34;events.created\u0026#34;, msg); err != nil { log.Println(\u0026#34;publish error:\u0026#34;, err) } time.Sleep(2 * time.Second) } Worker: a pull consumer with a durable name The key detail is that the worker has a durable name (worker-consumer). JetStream keeps this consumer\u0026rsquo;s read position, so if the worker restarts it resumes where it left off and receives the messages it missed:\nsub, err := js.PullSubscribe(\u0026#34;events.created\u0026#34;, \u0026#34;worker-consumer\u0026#34;) if err != nil { log.Fatal(err) } for { msgs, err := sub.Fetch(10, nats.MaxWait(5*time.Second)) if err != nil \u0026amp;\u0026amp; err != nats.ErrTimeout { log.Println(\u0026#34;fetch error:\u0026#34;, err) continue } for _, m := range msgs { log.Println(\u0026#34;Received:\u0026#34;, string(m.Data)) m.Ack() } } Fetch(10, ...) pulls up to 10 messages at once and Ack() tells JetStream processing is done. A message that isn\u0026rsquo;t acked gets redelivered.\nRunning it git clone git@github.com:h-agharezaei/go-nats-demo.git cd go-nats-demo docker compose up --build Then open the NATS dashboard at http://localhost:8222/. To see the durable consumer in action, stop only the worker service, start it again and watch the logs.\nNext steps This example is intentionally simple. For real workloads I want to dig into retry policy and MaxDeliver, dead-lettering, multiple workers on one consumer, and monitoring processing lag.\n","permalink":"https://hosseinagharezaei.ir/posts/nats-jetstream-go/","summary":"\u003cp\u003eWhen I want to really understand a concept, I build the smallest runnable example of it. This time it was \u003cstrong\u003eNATS JetStream\u003c/strong\u003e. The result is \u003ca href=\"https://github.com/h-agharezaei/go-nats-demo\"\u003ego-nats-demo\u003c/a\u003e: a publisher, a worker and NATS itself, all wired together with Docker Compose.\u003c/p\u003e\n\u003ch2 id=\"why-jetstream\"\u003eWhy JetStream?\u003c/h2\u003e\n\u003cp\u003eCore NATS only delivers messages to subscribers that are connected at that moment. If the worker is down, the message is gone. \u003cstrong\u003eJetStream\u003c/strong\u003e adds persistence on top of NATS: messages are stored in a stream, and consumers can read them later and acknowledge them.\u003c/p\u003e","title":"A Simple Publisher and Worker with NATS JetStream in Go"},{"content":"Hi! I\u0026rsquo;m Roham, a Senior Software Engineer based in Tehran.\nI mostly work with Go and Node.js, and I care about clean architecture, efficient APIs and the details that make backend systems reliable.\nWhat I work on Designing and building backend services and APIs Event-driven systems with Kafka and NATS JetStream Concurrency in Go: goroutines, contexts, connectivity and resilience Market data and technical-analysis tooling (candles, indicators, signals) Currently exploring Rust, through a market-analysis engine (quant-core) Quantitative analysis and multi-timeframe market structure Skills Languages: Go, TypeScript / Node.js (NestJS), Rust, Python Messaging: Apache Kafka, NATS JetStream Tooling: Docker, Docker Compose, Hugo, GitHub Actions Contact GitHub LinkedIn ","permalink":"https://hosseinagharezaei.ir/about/","summary":"\u003cp\u003eHi! I\u0026rsquo;m \u003cstrong\u003eRoham\u003c/strong\u003e, a Senior Software Engineer based in Tehran.\u003c/p\u003e\n\u003cp\u003eI mostly work with \u003cstrong\u003eGo\u003c/strong\u003e and \u003cstrong\u003eNode.js\u003c/strong\u003e, and I care about clean architecture, efficient APIs and the details that make backend systems reliable.\u003c/p\u003e\n\u003ch2 id=\"what-i-work-on\"\u003eWhat I work on\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDesigning and building backend services and APIs\u003c/li\u003e\n\u003cli\u003eEvent-driven systems with Kafka and NATS JetStream\u003c/li\u003e\n\u003cli\u003eConcurrency in Go: goroutines, contexts, connectivity and resilience\u003c/li\u003e\n\u003cli\u003eMarket data and technical-analysis tooling (candles, indicators, signals)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"currently-exploring\"\u003eCurrently exploring\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRust\u003c/strong\u003e, through a market-analysis engine (\u003ca href=\"https://github.com/h-agharezaei/quant-core\"\u003equant-core\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eQuantitative analysis and multi-timeframe market structure\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"skills\"\u003eSkills\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eLanguages:\u003c/strong\u003e Go, TypeScript / Node.js (NestJS), Rust, Python\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMessaging:\u003c/strong\u003e Apache Kafka, NATS JetStream\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTooling:\u003c/strong\u003e Docker, Docker Compose, Hugo, GitHub Actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"contact\"\u003eContact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/h-agharezaei\"\u003eGitHub\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.linkedin.com/in/hossein-agharezaei/\"\u003eLinkedIn\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","title":"About Me"},{"content":"Welcome to My Blog! This is the first post I\u0026rsquo;m publishing on my personal website.\nWhy Did I Create This Site? To share my experiences and knowledge To learn more To connect with people interested in similar topics To Be Continued\u0026hellip; I will publish more articles soon. Stay tuned!\n","permalink":"https://hosseinagharezaei.ir/posts/first-post/","summary":"\u003ch2 id=\"welcome-to-my-blog\"\u003eWelcome to My Blog!\u003c/h2\u003e\n\u003cp\u003eThis is the first post I\u0026rsquo;m publishing on my personal website.\u003c/p\u003e\n\u003ch2 id=\"why-did-i-create-this-site\"\u003eWhy Did I Create This Site?\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTo share my experiences and knowledge\u003c/li\u003e\n\u003cli\u003eTo learn more\u003c/li\u003e\n\u003cli\u003eTo connect with people interested in similar topics\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"to-be-continued\"\u003eTo Be Continued\u0026hellip;\u003c/h2\u003e\n\u003cp\u003eI will publish more articles soon. Stay tuned!\u003c/p\u003e","title":"My First Post"},{"content":"A selection of public projects. Many of them are hands-on practice for concepts I wanted to understand deeply.\nquant-core Rust — A high-performance market analysis engine for price action detection, fractal pattern recognition and multi-timeframe market structure. Currently focused on XAUUSD and EURUSD, designed to support any instrument.\ngo-gold-analyzer Go — Automated technical analysis for gold futures. Pulls Yahoo Finance data every minute, computes RSI, MACD and ATR, and emits BUY / SELL / HOLD signals with file logging.\ngo-nats-demo Go — Publisher and worker services on NATS JetStream with durable subscriptions, connection retry and the management dashboard, all via Docker.\ngo-kafka-first Go — Hands-on Kafka practice: topics, partitions, offsets and consumer groups, running on KRaft with Kafka UI via Docker Compose.\nnestjs-structure TypeScript — A NestJS project structure with environment-based configuration (default, development, production, test).\nGo concurrency notes Small experiments on goroutines and context: go-goroutine-01, go-context-01, go-connectivity-test.\n","permalink":"https://hosseinagharezaei.ir/projects/","summary":"\u003cp\u003eA selection of public projects. Many of them are hands-on practice for concepts I wanted to understand deeply.\u003c/p\u003e\n\u003ch2 id=\"quant-core\"\u003e\u003ca href=\"https://github.com/h-agharezaei/quant-core\"\u003equant-core\u003c/a\u003e\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eRust\u003c/strong\u003e — A high-performance market analysis engine for price action detection, fractal pattern recognition and multi-timeframe market structure. Currently focused on XAUUSD and EURUSD, designed to support any instrument.\u003c/p\u003e\n\u003ch2 id=\"go-gold-analyzer\"\u003e\u003ca href=\"https://github.com/h-agharezaei/go-gold-analyzer\"\u003ego-gold-analyzer\u003c/a\u003e\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eGo\u003c/strong\u003e — Automated technical analysis for gold futures. Pulls Yahoo Finance data every minute, computes RSI, MACD and ATR, and emits BUY / SELL / HOLD signals with file logging.\u003c/p\u003e","title":"Projects"}]